Privacy Policy

1. What VoxChat is

VoxChat is a browser extension that adds text-to-speech to AI chat websites (currently janitorai.com, with more sites planned). When an AI reply arrives on the page, VoxChat reads the text and speaks it aloud through the VoxRouter voice API. It runs only on the websites listed in the extension's host_permissions.

VoxChat is published by Focus Labs, 229 Rue Saint-Honoré, 75001 Paris, France. Contact: team@voxrouter.ai.

2. Data categories we handle (Chrome Web Store summary)

This table mirrors the Chrome Web Store "data usage" form the developer dashboard asks for. Each "Yes" below is expanded in sections 3-5.

We do not sell any user data. We do not share data for cross-context behavioral advertising. We do not permit third parties receiving data from us to use it for their own purposes.

3. What data VoxChat reads

On pages matching its host_permissions, VoxChat reads:

• The text content of AI replies as they render, so it can speak them aloud.
• The character name and chat identifier (from the page URL / DOM) so transcripts can be grouped per character and per chat.
• Network responses from the chat site's LLM endpoint when "Network mode" is enabled, so the spoken text matches the raw model output. Only responses matching known LLM streaming formats are read.

VoxChat does not read messages you type, your account credentials, cookies, passwords, payment information, or anything else on the page that is not an AI-generated reply.

4. What data VoxChat stores

The extension stores the following in chrome.storage.local on your device (never on our servers):

• Your VoxRouter API key.
• Your settings (voice choice, provider, duet-narration toggle, observer mode, gateway URL).
• A local transcript of text that has been spoken aloud, grouped by character and hour (up to 500 lines, oldest pruned). Cleared by pressing "Clear all transcripts" in the options page, or by removing the extension.

Local storage never leaves your browser. There is no cloud sync.

5. What data VoxChat transmits

5.1 To the VoxRouter API

When VoxChat speaks a line, it sends the text of that line (plus your chosen voice, model, and your API key as an Authorization header) over HTTPS to api.voxrouter.ai/v1/audio/speech. The VoxRouter gateway forwards the text to the third-party TTS provider you selected (OpenAI, ElevenLabs, etc.) and streams the synthesized audio back. See the VoxRouter Privacy Policy for how VoxRouter handles data on its side.

5.2 To Tinybird (analytics processor)

VoxChat emits a small number of telemetry events to Tinybird Co. S.L. (the event-analytics provider Focus Labs contracts with to detect bugs and outages) via api.voxrouter.ai/logs/v1/ingest. Events:

• tts.session.start — fires when a TTS call is initiated. Attributes: anonymous session ID, provider, voice, model, the 4-character prefix of your API key (used only to correlate your own usage if you email support), and the length of the text being spoken. The spoken text itself is never transmitted as telemetry.
• tts.session.end — fires when the TTS call completes or fails. Attributes: session ID, duration, provider, audio byte count, and (if any) error code.
• extension_installed — fires once on install.
• Uncaught JavaScript errors from the extension's code, so we can fix bugs we can't reproduce locally. Stack traces and error messages only — no page content.

VoxChat does not transmit chat content, character card data, typed messages, or any other chat-site content to Tinybird.

5.3 To the chat site

VoxChat does not send any data to the chat site it runs on. It only reads what the site already renders in your browser.

6. Third-party processors

We use the following processors to deliver VoxChat. Each processes data under a written data-processing agreement with Focus Labs.

• Cloudflare, Inc. — TLS termination, DDoS protection, worker runtime for the VoxRouter gateway and for voxchat.co. Processes transient request metadata (IP, headers) for routing and abuse prevention.
• Tinybird Co. S.L. — event analytics backend. Stores the telemetry events described in 5.2.
• The TTS provider you select — OpenAI, L.L.C. (for gpt-4o-mini-tts and similar voices), ElevenLabs, Inc. (for ElevenLabs voices), or any other provider exposed via the VoxRouter gateway. Receives the text of each AI reply you have VoxChat speak, plus your chosen voice and model parameters. Processes data under that provider's own privacy policy. We recommend reviewing the policy of whichever provider you pick before speaking sensitive content.
• Neon Database, Inc. and Stripe Payments Europe Ltd. — used only if you have a VoxRouter account for billing. The extension itself does not require an account. Details are in the VoxRouter Privacy Policy.

7. Retention

• Local data on your device (API key, settings, transcripts): retained until you clear it or uninstall the extension. Transcripts auto-prune after 500 lines.
• TTS request content (text sent to providers): not stored by VoxRouter. Providers retain per their own policies.
• Telemetry events in Tinybird (session metadata, errors): retained 90 days, then aggregated and the raw rows deleted.
• Cloudflare request logs (IPs, timestamps): retained by Cloudflare for the duration configured on our account, typically 7 days.

8. Security measures

• Encryption in transit. All traffic between the extension and our servers uses HTTPS/TLS 1.2+.
• Local isolation. Your API key is stored in chrome.storage.local, isolated per-extension by Chrome. Other extensions and websites cannot read it.
• No raw key in logs. Telemetry includes only the first 4 characters of the key ("key hint") for support correlation. The full key is never logged, never emailed, never displayed in any console.
• Minimum permissions. The extension requests only storage + offscreen, and is scoped to two domains. No access to tabs, cookies, browsing history, or any other site.
• Bundled code only. The extension does not load remote JavaScript. All code is bundled in the signed package Chrome installs.

9. International data transfers

Focus Labs operates from France (EU). Our processors (Cloudflare, Tinybird, OpenAI, ElevenLabs) are based in the United States or operate infrastructure there. This means your TTS request text and telemetry events are transferred outside the European Economic Area.

We rely on the European Commission's Standard Contractual Clauses (and, where applicable, the EU-U.S. Data Privacy Framework) as the legal transfer mechanism with each processor. Copies of our SCCs are available on request at team@voxrouter.ai.

10. Cookies and similar tracking

The VoxChat browser extension does not use cookies. It stores its settings in chrome.storage.local.

voxchat.co (this website) does not set any tracking or analytics cookies. Cloudflare may set short-lived security cookies required to protect the site from automated abuse — these are strictly necessary and do not track you across sites.

11. Your choices

• Disable voice by toggling "Enable voice" off in the options page. VoxChat will not transmit anything.
• Clear your local transcripts with "Clear all transcripts" in the options page.
• Uninstall the extension. This removes all extension-local storage (including your API key and transcripts).
• Contact us at team@voxrouter.ai to request deletion of any telemetry records associated with the 4-character prefix of your API key.

12. Legal basis (GDPR)

Processing is based on:

• Contract performance — for TTS calls you request via the extension.
• Legitimate interest — for diagnosing errors and detecting abuse (telemetry events, error reporting). Our interest is narrowly scoped to operating a reliable service and is balanced against your expectation that spoken content stays private.

Under the GDPR, you have rights to access, rectify, erase, port, restrict, or object to our processing, and to withdraw any consent you gave. Exercise any right by emailing team@voxrouter.ai. We reply within 30 days.

You also have the right to lodge a complaint with a supervisory authority. In France, that is the CNIL (Commission Nationale de l'Informatique et des Libertés, cnil.fr). See the VoxRouter Privacy Policy for the full GDPR schedule.

13. California residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act gives you the right to:

• Know what personal information we collect, use, and disclose.
• Delete personal information we hold about you.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising.
• Limit use of sensitive personal information.
• Non-discrimination for exercising any of these rights.

We do not sell or share personal information for cross-context behavioral advertising. If you still want to exercise any California right, email team@voxrouter.ai from the address associated with your VoxRouter account (or, if you only use the extension, include the 4-character prefix of your API key so we can locate your records).

14. Children

VoxChat is not intended for users under 18. We do not knowingly collect data from minors.

15. Changes to this policy

If this policy changes materially, the "Last updated" date above will change and the extension's release notes will mention it. Continued use of the extension after a change means you accept the updated policy.